Common significant deficiency examples in internal controls include former employees keeping active system logins after termination, complex journal entries approved without independent review, large credit memos processed without a second set of eyes, obsolete-inventory reserves updated too infrequently, and staff running key financial controls without formal training. Each is a breakdown in internal control over financial reporting that is more than trivial but falls short of a material weakness, which means it must be reported privately to the audit committee but does not force an adverse audit opinion or public disclosure.
What “Significant” Means in the Three-Tier Hierarchy
Public companies assess their internal controls over financial reporting each year under Sarbanes-Oxley Section 404, and the external auditor attests separately to that assessment.1Public Company Accounting Oversight Board. The Costs and Benefits of Sarbanes-Oxley Section 404 Any weakness identified falls into one of three tiers.
A control deficiency is the lowest tier. The control’s design or operation doesn’t let employees catch or prevent errors on time, but on its own it’s unlikely to produce a misstatement worth worrying about.
A significant deficiency is the middle tier. It’s a deficiency, or combination of deficiencies, less severe than a material weakness but important enough to merit attention from the people overseeing the company’s financial reporting.2Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
A material weakness is the top tier. There is a reasonable possibility that a material misstatement in the financial statements will not be prevented or detected in time.2Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements Under PCAOB standards, “reasonable possibility” means the likelihood is either reasonably possible or probable.3Public Company Accounting Oversight Board. AS 1305 – Communications About Control Deficiencies in an Audit of Financial Statements
Significant deficiency is the category where the potential error is more than trivial but not large enough on its own to change an investor’s decision.
IT Access and Change Management Examples
IT controls often touch every financial reporting area through a single system, which is why IT gaps commonly reach significant-deficiency status even when no actual error has occurred.
Poor user access management is one of the most frequent examples. Former employees who keep active login credentials after termination, or current employees whose access extends well beyond their job responsibilities, open the door to unauthorized transactions. The risk is real, but if the company runs daily transaction monitoring that would catch suspicious activity, that detective control often keeps the deficiency from escalating to a material weakness.
Weak change management for financial applications is another standard example. When developers can push code changes into production without independent review by a separate team, no one is verifying the changes work as intended. A coding error or intentional manipulation could alter how the system processes financial data. The breakdown in separation between development and production roles makes this a textbook significant deficiency.
Period-End Close Examples
The close process is where significant deficiencies surface most visibly, because estimates, judgments, and non-routine entries pile up at period-end.
A common example is failure to review complex, non-routine journal entries with adequate scrutiny. Management may thoroughly review standard monthly accruals but gloss over the support behind a year-end goodwill impairment entry or an unusual fair-value adjustment. These carry inherently higher misstatement risk, and skipping a rigorous review of the underlying assumptions means an error could slip through. The potential misstatement is substantial but typically limited to a specific account, which usually keeps it short of a material weakness.
Weak reconciliation procedures for complex liability accounts show up often as well. A high-level variance analysis instead of a detailed reconciliation of the underlying data lets differences hide inside the balance. A single liability account may not be large enough to produce a material misstatement, but the lack of rigor still demands audit committee attention.
Transaction Cycle Examples
Revenue Recognition
Revenue is a high-risk area by nature. A significant deficiency here might look like a missing independent review of credit memos above a set dollar threshold. If the credit manager can approve and process large revenue adjustments without accounting department review, misstated net revenue becomes a realistic possibility. The exposure is bounded by the volume of credit memos rather than the entire revenue stream, which usually keeps it in significant deficiency range.
Inventory Valuation
Inadequate support for the valuation reserve on obsolete or slow-moving inventory is a recurring example. If the reserve is calculated by formula but the inputs are reviewed only quarterly instead of monthly, the financial statements can carry a stale number for weeks. The delay doesn’t necessarily produce a material error, but the reserve is operating too slowly to reflect current conditions, and that gap warrants governance attention.
Control Environment and Governance Examples
Some significant deficiencies aren’t about one control failing at one moment. They’re about weaknesses in the foundation.
The absence of a formal training program for employees performing key financial controls is a common example. If the accounts payable clerk running the three-way match between purchase orders, receiving documents, and invoices learned the process informally, the reliability of that control rests on one person’s memory. The risk is diffuse, touching multiple transactions without concentrating in any single account, which typically keeps it below material weakness severity.
Failure to perform a risk assessment for a newly acquired business unit is another. Companies sometimes lean on the parent’s existing controls for the first year after an acquisition without formally evaluating where the subsidiary’s reporting risks actually sit. Even without an actual misstatement, the exposure is significant enough to warrant audit committee discussion.
How Auditors Decide a Deficiency Is “Significant”
Classification isn’t mechanical. Auditors weigh two factors: the likelihood that a misstatement could occur and the potential magnitude if it did. A gap that could produce a large error but has a very low chance of doing so may land differently than one with a modest dollar impact but a high probability.
Compensating controls matter heavily. A weak preventive control can be offset by a solid detective control that catches the same type of error. Auditors evaluate whether those backup controls are genuinely effective before classifying the gap.
PCAOB standards also identify conditions that are strong indicators a deficiency is at least a material weakness, which in turn marks the ceiling for significant deficiencies. Those indicators include fraud involving senior management, a restatement of previously issued financial statements, a material misstatement the auditor caught that the company’s own controls missed, and ineffective audit committee oversight.2Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements When none of those red flags appear but the deficiency is still more than trivial, you’re generally in significant deficiency territory.
Why the Classification Matters
When the auditor identifies a material weakness, PCAOB standards require an adverse opinion on internal control over financial reporting.2Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements A significant deficiency does not trigger an adverse opinion; the auditor can still conclude controls are effective overall.
Disclosure consequences differ just as sharply. Material weaknesses must appear in management’s report on internal controls in the annual report, and management cannot conclude controls are effective if one exists.4eCFR. 17 CFR 229.308 – (Item 308) Internal Control Over Financial Reporting Significant deficiencies are communicated privately to management and the audit committee and do not appear in SEC filings unless they combine into a material weakness.5U.S. Securities and Exchange Commission. Office of the Chief Accountant and Division of Corporation Finance Companies fight to keep a finding classified as significant rather than material, because crossing that line becomes a public disclosure that can move stock prices and invite regulatory attention.
Aggregation also matters. If several significant deficiencies affect the same account or the same reporting assertion, PCAOB standards require the auditor to evaluate whether they collectively rise to a material weakness.2Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements Three findings that individually stay below the threshold can combine into a reasonable possibility of a material misstatement. That is why audit committees take significant deficiency reports seriously even when each item looks manageable on its own.
What Happens After One Is Identified
Once the auditor identifies a significant deficiency, it must be communicated in writing to both management and the audit committee.3Public Company Accounting Oversight Board. AS 1305 – Communications About Control Deficiencies in an Audit of Financial Statements The written report describes the specific control that failed, why it was classified as significant rather than material, and the potential impact on the financial statements. The communication must go out before the auditor issues its report on internal controls over financial reporting.2Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
Sarbanes-Oxley Section 302 adds a personal layer. The CEO and CFO must certify in each periodic report that they have disclosed all significant deficiencies to the auditors and the audit committee, and must indicate whether any corrective actions have been taken since the last evaluation.6Office of the Law Revision Counsel. 15 USC 7241 – Corporate Responsibility for Financial Reports
Management then builds a remediation plan: root cause, redesigned control, named owner, and a timeline the audit committee can track. Implementation usually combines system changes, updated policies, and training for the staff who will operate the new control. Management performs follow-up testing over enough transactions and a long enough period to show the fix is working, and the external auditor independently tests the remediated control during the next audit cycle. The significant deficiency stays open in the audit committee’s tracking until that independent confirmation lands.